High 7.8Published Jun 24, 2026

CVE-2026-53097wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()

Updated under an hour ago (Oct 28, 2026, 12:10 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() When the mt7996 pci chip is detaching, the mt7996_crash_data is released in mt7996_coredump_unregister(). However, the work item dump_work may still be running or pending, leading to UAF bugs when the already freed crash_data is dereferenced again in mt7996_mac_dump_work(). The race condition can occur as follows: CPU 0 (removal path) | CPU 1 (workqueue) mt7996_pci_remove() | mt7996_sys_recovery_set() mt7996_unregister_device() | mt7996_reset() mt7996_coredump_unregister() | queue_work() vfree(dev->coredump.crash_data) | mt7996_mac_dump_work() | crash_data-> // UAF Fix this by ensuring dump_work is properly canceled before the crash_data is deallocated. Add cancel_work_sync() in mt7996_unregister_device() to synchronize with any pending or executing dump work.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	878161d5d4a469a6ef7f3fb4fe9f676bc508ee99 builds before 533b1a9fa0128c75e40dd2d2c38a32b4e660741f; 878161d5d4a469a6ef7f3fb4fe9f676bc508ee99 builds before 180182a3f23ff79430a32ca2c4c1885368ceab48; from 878161d5d4a469a6ef7f3fb4fe9f676bc508ee99 before aa4a31cd89f4fde5043ac613fe0e27014a60a60b; 878161d5d4a469a6ef7f3fb4fe9f676bc508ee99 builds before 188e10f9ea3109d23c6b7643aa6ec2f5cb0faa6d; from 878161d5d4a469a6ef7f3fb4fe9f676bc508ee99 before c8f62f73bbced3a79894655bdb0b625462d956fc	CNA record
linux linux_kernel linux:linux_kernel	from 6.4 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10	NVD

References

References

https://git.kernel.org/stable/c/533b1a9fa0128c75e40dd2d2c38a32b4e660741f
https://git.kernel.org/stable/c/180182a3f23ff79430a32ca2c4c1885368ceab48	patch
https://git.kernel.org/stable/c/aa4a31cd89f4fde5043ac613fe0e27014a60a60b	patch
https://git.kernel.org/stable/c/188e10f9ea3109d23c6b7643aa6ec2f5cb0faa6d	patch
https://git.kernel.org/stable/c/c8f62f73bbced3a79894655bdb0b625462d956fc	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.